News for hackers. Stuff that matters.

A comment on The modern HTTPS world has no place for old web servers. Parent comment

Re:The modern HTTPS world has no place for old web servers by Cthulhu_ on Wednesday May 13, 2020 @12:15PM (#23168431)
Maybe you have to include a secure access key with every request? Maybe DarkSky sets a cookie that they do not want anyone to be able to intercept or manipulate?

HTTPS by default is good, because you don't know what could go wrong. What if there's a security vulnerability in the dashboard widget that someone who can intercept and manipulate the response can abuse?

[ Parent | on HN ]
Re:The modern HTTPS world has no place for old web servers by evil-olive on Wednesday May 13, 2020 @06:42PM (#23172699)
Correct, for DarkSky the API key is embedded in the request URL [0]. Their pricing is generous (1000 requests/day are free, after than $1 per 10,000 requests) but there is definitely the risk that traffic over HTTP could have the URL sniffed, and then be used to make charges on that customer's behalf.

0: https://darksky.net/dev/docs

[ Parent | on HN ]